mirror of
https://github.com/opnsense/src.git
synced 2026-02-27 03:40:37 -05:00
b483b6b256
The final transmit and receive queue indices need to be positive
values. However, since txq_idx and rxq_idx are signed (to permit
using -1 to as a marker for uninitialized values), using %= with
another integer type (vi->nofld[tr]xq) yielded a sign-extended modulus
value. This resulted in negative queue indices and a buffer underrun
when arc4random() returned a value with the sign bit set. Use a
temporary unsigned variable to hold the "raw" queue index to force
unsigned modulus.
This worked previously because the modulus was previously applied
directly to the return value of arc4random() which is unsigned before
the result was assigned to txq_idx and rxq_idx.
Discussed with: np
Fixes:
|
||
|---|---|---|
| .. | ||
| t4_connect.c | ||
| t4_cpl_io.c | ||
| t4_ddp.c | ||
| t4_listen.c | ||
| t4_tls.c | ||
| t4_tls.h | ||
| t4_tom.c | ||
| t4_tom.h | ||
| t4_tom_l2t.c | ||
| t4_tom_l2t.h | ||